Hackers have leveraged a vulnerability in the Collabora Online – Built-in CODE Server, an optional Nextcloud application, to deploy web shells on Nextcloud servers. This issue was identified by three administrators on GitHub, with the initial reported attack occurring on September 10.
A web shell allows attackers to execute commands via web requests with the server’s permissions. The vulnerability permits unauthorized command execution when the app’s local document server is inactive, such as during restarts, upgrades, or crashes. Collabora addressed the issue in version 26.4.303 on September 11 and issued an advisory on October 14, labeled CVE-2026-110447, emphasizing the necessity of updating or removing the app rather than merely disabling it.
Impact on Users
The affected application, identified by the package name richdocumentscode, integrates the Collabora Online Development Edition (CODE) within the Nextcloud server environment. This configuration enables document editing without an external Collabora server, intended for testing and small-scale use. Collabora’s advisory highlights that all versions before 26.4.303 are vulnerable, but standalone Collabora Online servers remain unaffected. Warnings on the Nextcloud community forum clarified that installations using only the Nextcloud Office app are not impacted if they operate a Collabora server externally.
The vulnerability stems from the app’s proxy.php script, which launches the local CODE server upon receiving a request when inactive. In affected versions, the script incorporated request text, including paths, into a bash command, executing any path-contained commands as the web server user. The exploit requires the server to be down, aligning with conditions like restarts or crashes.
Reported Attacks
The initial report emerged from an administrator managing several Nextcloud servers, noting unauthorized access from September 10. Access logs revealed malicious requests targeting the proxy.php script, embedding commands to deploy a PHP web shell. This shell attempted to transmit server data to a specified address and searched for sensitive files such as credential stores and cryptocurrency wallets. Although no files were archived or extracted, any readable content by the web server account is considered compromised.
Additional administrators reported similar incidents. One detected the web shell through Nextcloud’s integrity checks, while another was alerted by failed sudo attempt notifications. None of these reports indicated root access breaches. Following an update to version 26.4.303, another attack attempt was recorded on September 14, but without success.
Protective Measures
To mitigate the risk, users must update the richdocumentscode app to version 26.4.303 or later, or uninstall it entirely, as disabling alone is insufficient. Users on outdated Nextcloud versions should upgrade to accommodate the security patch. Post-update, users should search for and delete any PHP files prefixed with “shx” within the app directory and review access logs for suspicious requests.
A subsequent version, 26.4.402, aimed to enhance security by refining command execution, though it faced operational issues, leading some administrators to revert to the previous fix. The necessity of vigilance remains, as the extent of affected servers is unclear. The CVE acknowledgment followed a delay, with Collabora’s advisory finally issued to prompt immediate updates.
